CVE-2017-12620 Improper Restriction of XML External Entity Reference in Apache OpenNLP
Attackers can perform XML External Entity attacks by loading malicious models or dictionaries, potentially reading sensitive data or causing denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-12620?
CVE-2017-12620 is a critical vulnerability in Apache OpenNLP, published on 2 Oct 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
When loading models or dictionaries that contain XML it is possible to perform an XXE attack, since Apache OpenNLP is a library, this only affects applications that load models or dictionaries from untrusted sources. The versions 1.5.0 to 1.5.3, 1.6.0, 1.7.0 to 1.7.2, 1.8.0 to 1.8.1 of Apache OpenNLP are affected.
Weakness: CWE-611
Which versions are affected by CVE-2017-12620?
2 open source packages ship an affected version, including org.apache.opennlp:opennlp-tools. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.opennlp:opennlp-tools Maven | From 1.5.0 | 1.8.2 |
org.apache.opennlp:opennlp-tools Maven | From 1.5.0 | 1.8.2 |
Products include Apache Opennlp.
How do I fix CVE-2017-12620?
Upgrade org.apache.opennlp:opennlp-tools to 1.8.2 or later.
Is CVE-2017-12620 being exploited?
There is no known exploitation of CVE-2017-12620 in the wild and no public exploit code.
Other vulnerabilities in Apache OpenNLP
- CVE-2026-82617 Apache OpenNLP, Apache OpenNLP: ReDoS / stack exhaustion in RegexNameFinderFactory built-in EMAIL and URL patterns
- CVE-2026-42027 Apache OpenNLP: Arbitrary Class Instantiation via Model Manifest in ExtensionLoader
- CVE-2026-40682 Apache OpenNLP: XXE via Dictionary Parsing in DictionaryEntryPersistor
- CVE-2026-67211 Apache OpenNLP: OOM DoS via Unbounded Array Allocation in SymSpellModelSerializer
- CVE-2026-42440 Apache OpenNLP: OOM DoS via Unbounded Array Allocation in AbstractModelReader
Sources
Also known as GHSA-h22x-hm8g-rxpg.